<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span style='mso-fareast-language:EN-US'>AB 00 00 03 00 00 is the All Routers address. It is likely a router sending a Hello message advertising its presence, presumably coming from node 63.779.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'>Regards<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'>Rob<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US>From:</span></b><span lang=EN-US> owner-hecnet@Update.UU.SE <owner-hecnet@Update.UU.SE> <b>On Behalf Of </b>Thomas DeBellis<br><b>Sent:</b> 11 January 2021 19:33<br><b>To:</b> HECnet <hecnet@Update.UU.SE><br><b>Subject:</b> [HECnet] Thousands of DECnet errors on Tops-20<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>I was wondering if anybody else had either seen the below or noticed it. I didn't have as free space on my public structure as I thought I should, so I went poking around and found:<o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p><span style='font-size:13.5pt;font-family:"Courier New"'> TOMMYT:<SYSTEM-ERROR> Pages Bytes(Size) Write Date and Time Writer <br><br> ERROR.SYS.1;P777752 138,495 70909216(36) 11-Jan-2021 14:20:29 OPERATOR </span><o:p></o:p></p></blockquote><p>To put this into perspective, we are looking at about a 304 MB file; it's larger than what could have been held on an RP06 So I ran SPEAR and pulled down a few of the most recent items, viz:<o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p><tt><span style='font-size:10.0pt'>***********************************************</span></tt><span style='font-size:10.0pt;font-family:"Courier New"'><br><tt>DECNET ENTRY</tt><br><tt> LOGGED ON 9-Jan-2021 19:02:18-EST MONITOR UPTIME WAS 113 day(s) 0:50:12</tt><br><tt> DETECTED ON SYSTEM # 3691.</tt><br><tt> RECORD SEQUENCE NUMBER: 28063.</tt><br><tt>***********************************************</tt><br><tt>DECNET Event type 5.15, Receive failed</tt><br><tt>From node 2.522 (VENTI2), occurred 9-JAN-2021 19:02:08</tt><br><br><tt> Line NI-0-0</tt><br><br><tt> Failure reason = Frame too long</tt><br><tt> Ethernet header = AB 00 00 03 00 00 / AA 00 04 00 FF 0B</tt></span><o:p></o:p></p></blockquote><p>There are hundreds of thousands of these, causing ERROR.SYS to grow by a number of pages every day. I didn't remember how to turn a DECnet node number into dotted decimal, but I did notice the follow from the DECnet bridge (SIGUSR1):<o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p><tt><span style='font-size:10.0pt'>Host table:</span></tt><span style='font-size:10.0pt;font-family:"Courier New"'><br><tt>0: purgatorio 0.0.0.0:0 (Rx: 2963632 (3352330) Tx: 1687334 Fw: 1276298 (Drop rx: 2076032)) Active: 1 Throttle: 598 (203)</tt><br><tt>1: legato 108.65.195.50:4711 [Ov: 0, Nov: 1693548, Lst: 0] (Rx: 1687334 (1693548) Tx: 1276298 Fw: 1687334 (Drop rx: 6214)) Active: 1 Throttle: 9054(070)</tt><br><tt>Hash of known destinations:</tt><br><tt>aa000400080a -> 0 (2.520)</tt><br><tt>aa0004000a0a -> 0 (2.522)</tt><br><tt>aa000400ff0b -> 1 (2.1023)</tt></span><o:p></o:p></p></blockquote><p>So one of these is coming over that bridge (2.1023). What is <tt><span style='font-size:10.0pt'>AB 00 00 03 00 00</span></tt>? Anybody have any ideas of what's going on? I haven't looked in the monitor code, yet. If you are running any 36 bit OS, what are you seeing?<o:p></o:p></p></div></div></body></html>